Newer
Older
---
title: Unix Processes
---
# Unix Processes
[](http://creativecommons.org/licenses/by-sa/4.0/)
Objective: Understand how process works in GNU/Linux
A Program is a list of intructions to be executed on a computer. These instruction are written in one or many files in a format readable by the computer (binary files), or interpertable by the computer (text file). The interpretable format need to be processed by an interperter who is in binary format.
The execution of a program on the system is represented as one or many processes. The program is the file of instruction while the process is the instructions being read.
`mkdir` is the program, when you type `mkdir my_folder`, you launch an `mkdir` process.
Your shell is a process to manipulate other processes.
> In multitasking operating systems, processes (running programs) need a way to create new processes, e.g. to run other programs. [Fork](https://en.wikipedia.org/wiki/Fork_(system_call)) and its variants are typically the only way of doing so in Unix-like systems. For a process to start the execution of a different program, it first forks to create a copy of itself. Then, the copy, called the "[child process](https://en.wikipedia.org/wiki/Child_process)", calls the [exec](https://en.wikipedia.org/wiki/Exec_(system_call)) system call to overlay itself with the other program: it ceases execution of its former program in favor of the other.
Some commands in your shell don't have an associated process, for example there is no `cd` program, it's a functionnality of your shell. The `cd` command tell your `bash` process to do something not to fork another process.
## Process attributes
- PID : the **p**rocess **id**entifier is an integer, at a given time each PID is unique to a process
- PPID : the **p**arent **p**rocess **id**entifier is the PID of the process that has stared the current process
- UID : the **u**ser **id**entifier, is the identifier of the user that has started the process, except for SE Linux, the process will have th same right as the user launching it.
- PGID : the **p**rocess **g**roup **id**entifier (like users process have groups)
You can use the command `ps` to see thes process launched by your user
```sh
ps
```
Like for the command `ls` you can use the switch `-l` to have more details
Open another tab in your browser to log again on your VM. Keep this tab open, we are going to use both of them in this session.
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
In this new tab, you are going to launch a `less` process
```sh
less .bashrc
```
Comme back, to your first tab, can you see your `less` process with the command `ps` ?
The `ps` option `-u [login]` list all the process with `UID`the `UID`associated with `[login]`
```sh
ps -l -u etudiant
```
Is the number of `bash` processes consistent with the number of tabs you openned ?
What is the PPID of the `less` process ? Can you identify in which `bash` process `less` is running ?
Did you launch the `systemd` and `(sd-pam)` process ?
`pam` stand for [**p**luggable **a**uthentication **m**odules](https://www.linux.com/news/understanding-pam/), its a collection of tools that handle identification and resource access restriction. From the PPID of the `(sd-pam)` can you find which process launched `(sd-pam)` ? What is the PPID of this process ?
The option `-C` allow you to filter process by name
```sh
ps -l -C systemd
```
Who launched the first `systemd` process ?
From PPID to PPID, you can guess that like the file system, processes are organized in a tree. The command `pstree` can give you a nice representation of this tree.
The following `ps` command show information on the process with PID 1
```sh
ps -l -1
```
Can you look at the corresponding program (with the command `which`) ?
Can you look for informations on PID 0 ?
The root of the processes tree is the PID 1.
What is the UID of the `dockerd` process, can you guess why we were able to gain `sudo` access in the previous section by using a `docker` command ?
While `ps` give you a static snapshot of the processes but processes are dynamic. To see them running you can use the command `top`. While `top` is functional, most system have `htop` with a more accessible interface. You can test `top` and `htop`.
Like `ps` you can use `-u etduiant` with htop to only display your user process
With the `F6` key you can change the column on which to sort your process.
- Which process is consuming the most of CPU ?
- Which process is consuming the most of memory ?
What is the difference between `M_SIZE` (`VIRT` column), `M_RESIDENT` (`RES` column) and `M_SHARE` (`SHR` column) ? To which value, the column `MEM%` correspond to ?
- `M_SIZE` : The total amount of virtual memory used by the task. It includes all code, data and shared libraries plus pages that have been swapped out and pages that have been mapped but not used (If an application requests 1 GB of memory but uses only 1 MB, then `VIRT` will report 1 GB).
- `M_RESIDENT` : what's currently in the physical memory. This does not include the swapped out memory and some of the memory may be shared with other processes (If a process uses 1 GB of memory and it calls `fork()`, the result of forking will be two processes whose `RES` is both 1 GB but only 1 GB will actually be used since Linux uses copy-on-write).
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
- `M_SHARE` : The amount of shared memory used by a task. It simply reflects memory that could be potentially shared with other processes.
Wait what is swapped out memory ?
> Linux divides its physical RAM (random access memory) into chucks of memory called pages. Swapping is the process whereby a page of memory is copied to the preconfigured space on the hard disk, called swap space, to free up that page of memory. The combined sizes of the physical memory and the swap space is the amount of virtual memory available.
And as you HDD (even your fast SSD) is way slower than your RAM, when you run aout of RAM and the system start to swapped out memory, things will start to go realy slowly on your computer. Generally you want to avoid swapping. The swap space is often a dedicated partition in the *Linux_swap* format.
From the `htop` command, what is the size of the swap space on your VM ?
## Process control
You have control over all the process launched with your UID. To test this control we are going to use the well named command `sleep`. Check the **man**ual of the `sleep` command.
Launch the `sleep` for 3600 second.
You don't have a prompt, it's means that the last command (`sleep`) is running.
### Terminate
Instead of taking a nap and come back at the end of this session, we may want to interupt this command. The first way to do that is to ask the system to terminate the `sleep` process.
From your terminal you can press `ctrl` + `c`. This short-cut terminate the current process, it work everywhere except for programs like `man` or `less` which can be closed with the key `q`.
Launch another long `sleep` process and switch to your other terminal tab and list your active process
```sh
ps -l -u etudiant
```
Another way to terminate the current process is with the command `kill`. `kill` is used to send a signal to a process with the command:
```sh
kill -15 PID
```
We can do the same thing as with the command `ctrl` + `c`: ask nicely the process to terminate itself. The `-15` signal is called the SIGTERM.
On rare occasions a buggy process will not be able to listen to signals anymore. The signal `-9` will kill a process (not nicely at all). The `-9` signal is called the SIGKILL signal. There are 64 different signal that you can send with the `kill` command.
In your current terminal type the `bash` command, nothing happen. You have a shell within a shell. Launch a long `sleep` command and switch to the other tab.
You can use the `ps` command to check that `sleep` is running within a `bash` within a `bash`
```sh
ps -l --forest -u etudiant
```
Nicely terminate the intermediate `bash`. What happened ?
Try not nicely. What happened ?
A process with a PPID of 1 is called a **daemon**, daemon are processes that run in the background.
### Suspend
Launch `htop` then press `ctrl` + `z`. What happened ?
```sh
ps -l -u etudiant
```
The manual of the `ps` command say the following about process state
> ```
> D uninterruptible sleep (usually IO)
> I Idle kernel thread
> R running or runnable (on run queue)
> S interruptible sleep (waiting for an event to complete)
> T stopped by job control signal
> t stopped by debugger during the tracing
> W paging (not valid since the 2.6.xx kernel)
> X dead (should never be seen)
> Z defunct ("zombie") process, terminated but not reaped by its parent
> ```
You can use the command `fg` to put `htop` in the **f**or**g**round.
Close `htop` and type two time de following command:
```sh
htop &
```
Type the command `jobs`. What do you see ? You can specify which `htop` process you want to bring to the forground with the command `fg %N` with `N` the number of the job.
```sh
fg %2
```
Bring the 2nd `htop` to the forground. Put it back to the background.